Microsoft on Friday reported that a glitch is causing Windows to tell users that Microsoft Defender Antivirus is turned off when it is in fact fully functional, a bug that the vendor says it is working to fix.
Consultants say that this advisory raises a major concern in that it will train users to ignore critical alerts, which makes them far more susceptible to attacks.
The Microsoft release health dashboard update on the issue reported: “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off’ even though the antivirus is functioning correctly and all settings show it as active. These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off. This issue can be observed in any version of Windows or Windows Server with Microsoft Defender Antivirus running with the latest Defender updates.”
The post added: “We are working to release a resolution in a future Microsoft Defender Antivirus update and will provide more information when it is available.”
It then listed the various Windows client and server versions impacted: everything from the current Windows 11, version 26H1 and Windows Server 2025 back to Windows 10 Enterprise LTSC 2016 and Windows Server 2012.
Industry observers said the suggestion that users ignore these alerts is concerning.
“Microsoft has just published guidance telling enterprises to ignore the exact signal that precedes a large share of ransomware detonations,” said Aman Mahapatra, chief strategy officer for technology consulting firm Tribeca Softtech, pointing out that disabling endpoint protection is standard tradecraft across virtually every ransomware affiliate playbook over the last five years.
“The alert Microsoft is telling people to disregard is the same alert an operator triggers minutes before encryption starts,” he said. “That is a genuine security regression created by a bug advisory and the open-ended timeline on a fix makes it worse.”
More disturbingly, he expects many security operations centers (SOCs) will create rules to suppress these alerts, which will make the problem even more severe.
“When a signal fires constantly and is known to be false, human response degrades in days, not weeks,” Mahapatra said. “A SOC seeing hundreds of these across a Windows fleet will write a suppression rule by next week, because the alternative is drowning [in false alerts], and that rule will outlive the bug by months. Nobody goes back to remove filters that are keeping the queue clean.”
Mahapatra also predicted that attackers will quickly leverage the bug to help in social engineering attacks.
“An attacker calling a help desk with ‘You’ll see Defender alerts on my machine, Microsoft says it’s the known bug, ignore it’ now has a corroborating vendor advisory backing the pretext,” Mahapatra said. “Help desks have been primed for exactly this issue. That is a working pretext with public documentation behind it, and it will get used.”
Lane Thames, team lead for cybersecurity R&D at Fortra, amplified Mahapatra’s concerns.
“IT teams need to be very careful about how they communicate this problem to users, and that communication should happen immediately,” Thames advised. “The message cannot simply be, ‘If Windows says Defender is turned off, ignore it.’ That is exactly the behavior we spend years teaching users not to adopt.”
“The better message is that Microsoft is currently experiencing a known notification issue with Microsoft Defender, but users should continue reporting security warnings through the normal help desk or security channel,” he said. “IT should verify Defender’s actual state rather than asking users to make that determination, otherwise, when the next warning is real, users may have already been trained to ignore it.”
